[tjdonley]

Summary

• Escape untrusted report fields before writing Markdown so issues, evidence, recommendations, and cost rows cannot inject links, HTML, images, reference definitions, or table breaks.
• Preserve JSON payloads while using safe inline-code fences and safe generated artifact link targets.
• Add regression coverage for malicious Markdown, HTML, and autolink input.

Verification

• uv run pytest tests/test_report.py
• uv run pytest
• uv build
• git diff --check